In breve
- CVE-2025-25977 è una vulnerabilità CRITICO (CVSS 9.8) che riguarda canvg (canvg), canvg.
- Probabilità di sfruttamento nei prossimi 30 giorni (EPSS): 0.71%, superiore al 53.9% delle vulnerabilità.
- Correzione: aggiornare a 4.0.3, 3.0.11 o successiva.
| Package | Affected versions | Patched versions |
|---|
| canvg | ≥ 4.0.0, < 4.0.3< 3.0.11
| 4.0.33.0.11
|
| canvg npm | ≥ 4.0.0, < 4.0.3< 3.0.11
| 4.0.33.0.11
|
Description
An issue in canvg prior to v.4.0.3 and v3.0.11 can lead to prototype pollution via the Constructor of the class StyleElement.
NVD description
An issue in canvg v.4.0.2 allows an attacker to execute arbitrary code via the Constructor of the class StyleElement.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free